                (get-in response [:session :csrf-token]) =not=> "staleCSRFtoken"))
 
        (fact "posting to authorisation endpoint redirects to callback with auth code and adds the client to the user's authorised clients"
-             (let [user (user/store-user! @storage/user-store user-email "password")
+             (let [user-store (m/create-memory-store)
+                   user (user/store-user! user-store user-email "password")
                    client-details (cl-client/register-client @storage/client-store "MYAPP" "myapp.com")
                    access-token (cl-token/create-token @storage/token-store client-details user)
                    csrf-token "CSRF-TOKEN"


(facts "about authorisation end-point"
       (fact "request with client-id, response_type and redirect_uri returns redirect to login page if there is no user session"
             (let [client-details (cl-client/register-client @storage/client-store "ClientTestApp" client-url) ;FORMAT => {:client-secret "XLFCQRKJXSV3T6YQJL5ZJJVGFUJNT6LD", :client-id "RXBX6ZXAER5KPDSZ3ZCZJDOBS27FLDE7", :name "ClientTestApp", :url "localhost:3001"}
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)
                                                                    {:client_id     (:client-id client-details)
                                                                     :response_type "code"
                                                                     :redirect_uri  client-url})
                               (r/header "accept" "text/html"))
                   response (oauth/authorise @storage/user-store request)]
               (:status response) => 302
               (-> response (get-in [:headers "Location"])) => "/sign-in"
               (-> response (get-in [:session :return-to])) => (format "/authorisation?client_id=%s&response_type=code&redirect_uri=%s" (:client-id client-details) (hiccup/url-encode client-url))))

       (fact "valid request goes to authorisation page with auth_code and email when there is an existing user session"
             (let [user (user/store-user! @storage/user-store user-email "password")
                   client-details (cl-client/register-client @storage/client-store "MYAPP" client-url) ; NB this saves into the client store
                   access-token (cl-token/create-token @storage/token-store client-details user) ; NB this saves into the token store
                   request (-> (th/create-request-with-query-string :get (routes/path :authorise)

            (encode-client-info client)))

(facts "about token endpoint"
       (let [user-store (m/create-memory-store)
             user (user/store-user! user-store user-email "password")
             client-details (cl-client/register-client @storage/client-store "MYAPP" "http://myapp.com")
             auth-code (cl-auth-code/create-auth-code @storage/auth-code-store client-details user "http://myapp.com/callback")
             request (-> (th/create-request-with-query-string :get (routes/path :validate-token) {:grant_type   "authorization_code"
                                                                                                  :redirect_uri "http://myapp.com/callback"
                                                                                                  :code         (:code auth-code)})
                         (create-auth-header client-details))
             response (oauth/validate-token user-store request)
             response-body (-> response :body (json/parse-string keyword))]

         (fact "request with grant type authorization_code and correct credentials returns access token"
